What is the safest default firewall policy between network zones?

Problem Statement

Start closed, then open only what the business needs. This limits lateral movement and reduces blast radius when a host is compromised.

SolutionRead Only

Default: drop; Allow: tcp 443 to updates.example only

This question appears in the following practice sets: